OpenSSF Scorecard #289
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenSSF Scorecard — measures supply-chain security posture. | |
| # Eat our own dog food: uzomuzo leverages Scorecard data, so we run it on ourselves. | |
| # https://github.com/ossf/scorecard-action | |
| name: OpenSSF Scorecard | |
| on: | |
| branch_protection_rule: | |
| schedule: | |
| # Weekly: Monday 01:30 UTC | |
| - cron: "30 1 * * 1" | |
| push: | |
| branches: [main] | |
| permissions: read-all | |
| jobs: | |
| scorecard: | |
| name: Scorecard analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload SARIF results | |
| id-token: write # OIDC token for Scorecard API | |
| contents: read | |
| actions: read # read workflow details for token-permissions check | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Run OpenSSF Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 | |
| with: | |
| sarif_file: results.sarif | |
| - name: Upload Scorecard results artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: scorecard-results | |
| path: results.sarif | |
| retention-days: 5 |